Acceptable Use Policy

These tools protect confidential material. That is what they are built for, and it is the only thing they may be used for. This policy is part of the Terms of Use, and paying for a pass means accepting it.

Last updated: September 4, 2026.

What the suite is for

Every tool here exists to keep material that is lawfully yours, or lawfully entrusted to you, from reaching people who have no right to it. In practice that means work like this:

Confidentiality and NDA compliance. Sending a draft, a model or a set of figures to a counterparty without leaving it on a third party server.
Trade secret protection. Keeping recovery keys, formulations, client lists and unreleased work encrypted at rest and off shared drives.
Legal and professional privilege. Handling privileged material without routing it through a cloud provider that would break the chain.
Redaction done properly. Removing information from a document you are lawfully entitled to redact, in a way that actually removes it, before disclosure or publication.
Data minimisation. Stripping location, device identifiers and authorship from files before you publish or share them, which is what privacy law asks you to do.
Getting paid. Holding your own finished work until the invoice you are owed is settled.
Leak attribution. Marking your own confidential document per recipient so you can tell where a copy came from.
Reading what you were sent. Examining a file someone sent you to see what it discloses about its origin before you rely on it.

What you may not do

You may not use OBSCURA OS, or anything produced with it, to do any of the following. This list is not exhaustive, and nothing on it becomes acceptable because it is technically possible.

Tamper with evidence. Destroy, alter, conceal or fabricate material that is relevant to an investigation, audit, litigation, regulatory proceeding or insolvency, whether it is already under way or you reasonably expect it.
Defeat a duty of disclosure. Withhold or disguise material from a court, regulator, auditor, tax authority, employer or counterparty to whom you owe a legal or contractual duty to produce it.
Extort or coerce. Withhold data, files or access to demand money or conduct, including withholding deliverables you have no right to withhold.
Deliver malicious code. Package, hide or transmit malware, exploits, ransomware or unauthorised access tooling, including inside a carrier file.
Trade illegally. Arrange or conceal dealings in illegal goods, services, weapons, stolen data or the proceeds of crime, or evade sanctions or export controls.
Handle unlawful material. Store, transmit or conceal child sexual abuse material or any other content whose possession is unlawful where you are.
Harm a person. Stalk, harass, threaten, dox or locate someone against their will, or defeat a protective, restraining or safeguarding order.
Take what is not yours. Infringe copyright, misappropriate someone else’s trade secrets, or exfiltrate an employer’s or client’s confidential material in breach of your obligations to them.
Misrepresent a document. Strip a watermark, signature or provenance marker in order to pass work off as your own, or produce a file intended to be mistaken for a genuine record you did not create.
Attack the service. Break, share or circumvent the pass or any access control, resell access, or automate use in a way that degrades the site for others.

Where the line falls

The difference between protecting information and hiding it is not about the tool. It is about what you owe, and to whom.

Stripping the GPS coordinates from a photograph before you publish it is data minimisation, and it is good practice. Stripping them from a photograph a court has ordered you to produce is evidence tampering. The software cannot tell those apart; you can, and you are the one accountable for it.

The same applies throughout. Encrypting a deliverable until an invoice clears is commerce. Encrypting records a liquidator has asked for is not. Redacting a client name before a case study goes out is confidentiality. Redacting it from a regulatory filing is a false statement.

If you are subject to a litigation hold, a preservation notice, a production order or a regulatory request, your obligation to preserve and produce material overrides any use of this software. Nothing here is a defence, and nothing here is legal advice. If you are unsure whether a duty applies to you, ask a lawyer before you act, not after.

What we can and cannot do about misuse

Every tool runs inside your browser. Your files are never uploaded, so we cannot inspect them, retrieve them, decrypt them or produce them for anyone. That is a deliberate design decision and it does not change for law enforcement, for us, or for you if you lose a key.

What we can do is limited and we would rather state it than imply more. We can withdraw access and refuse a refund where this policy has been breached. We hold no documents and no account records; the only information connected to a purchase is the payment record held by our payment processor, and we respond to lawful process to the extent of what we actually have, which is very little.

We do not build backdoors, and we will not add one. A tool that can be opened by us can be opened by whoever compromises us, which would put every lawful user at risk to catch the few who are not.

Reporting misuse

If you believe OBSCURA OS has been used against you or in breach of this policy, write to [email protected] with as much detail as you can give. We read every report. Be aware of the limits above: we can act on access, not on files we have never held.

Enforcement and changes

Breach of this policy terminates your right to use the service immediately, without refund, and is a breach of the Terms of Use. We may update this policy; the date at the top shows when it last changed, and continuing to use the site after a change means accepting it.